UseCorrectCasing gets NullReferenceException from CommandInfo.get_Parameters

[bill-long]

Steps to reproduce

This reproduces about 25% of the time on my laptop. I think we may be exposing a gap in the fix for #1516, perhaps because we have about 250 .ps1 files in the repo.

• Clone https://github.com/microsoft/CSS-Exchange
• Change into that folder and run:

Get-ChildItem *.ps1 -Recurse | % { Invoke-ScriptAnalyzer -Path $_ -Settings .\PSScriptAnalyzerSettings.psd1 }

• If it doesn't reproduce on the first try, launch a new PowerShell window, cd into the folder, and try again.

Expected behavior

No error.

Actual behavior

Invoke-ScriptAnalyzer: Object reference not set to an instance of an object.

If an unexpected error was thrown then please report the full error details using e.g. $error[0] | Select-Object *

PSMessageDetails      :
Exception             : System.NullReferenceException: Object reference not set to an instance of an object.
                           at System.Management.Automation.CommandInfo.get_Parameters()
                           at Microsoft.Windows.PowerShell.ScriptAnalyzer.BuiltinRules.UseCorrectCasing.AnalyzeScript(Ast ast, String fileName)+MoveNext()
                           at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
                           at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
                           at Microsoft.Windows.PowerShell.ScriptAnalyzer.ScriptAnalyzer.<>c__DisplayClass82_1.<AnalyzeSyntaxTree>b__2()
TargetObject          : D:\code\CSS-Exchange\Diagnostics\ExchangeLogCollector\RemoteScriptBlock\IO\Copy-BulkItems.ps1
CategoryInfo          : InvalidOperation: (D:\code\CSS-Exchang…\Copy-BulkItems.ps1:String) [Invoke-ScriptAnalyzer], NullReferenceException
FullyQualifiedErrorId : RULE_ERROR,Microsoft.Windows.PowerShell.ScriptAnalyzer.Commands.InvokeScriptAnalyzerCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
                        at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {0, 1}

❯ Get-Error $Error[0]

Exception             :
    Type       : System.NullReferenceException
    TargetSite :
        Name          : get_Parameters
        DeclaringType : System.Management.Automation.CommandInfo
        MemberType    : Method
        Module        : System.Management.Automation.dll
    StackTrace :
   at System.Management.Automation.CommandInfo.get_Parameters()
   at Microsoft.Windows.PowerShell.ScriptAnalyzer.BuiltinRules.UseCorrectCasing.AnalyzeScript(Ast ast, String fileName)+MoveNext()
   at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
   at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
   at Microsoft.Windows.PowerShell.ScriptAnalyzer.ScriptAnalyzer.<>c__DisplayClass82_1.<AnalyzeSyntaxTree>b__2()
    Message    : Object reference not set to an instance of an object.
    Source     : System.Management.Automation
    HResult    : -2147467261
TargetObject          : D:\code\CSS-Exchange\Diagnostics\ExchangeLogCollector\RemoteScriptBlock\IO\Copy-BulkItems.ps1
CategoryInfo          : InvalidOperation: (D:\code\CSS-Exchang…\Copy-BulkItems.ps1:String) [Invoke-ScriptAnalyzer], NullReferenceException
FullyQualifiedErrorId : RULE_ERROR,Microsoft.Windows.PowerShell.ScriptAnalyzer.Commands.InvokeScriptAnalyzerCommand
InvocationInfo        :
    MyCommand        : Invoke-ScriptAnalyzer
    ScriptLineNumber : 1
    OffsetInLine     : 36
    HistoryId        : 2
    Line             : Get-ChildItem *.ps1 -Recurse | % { Invoke-ScriptAnalyzer -Path $_ -Settings .\PSScriptAnalyzerSettings.psd1 }
    PositionMessage  : At line:1 char:36
                       + … curse | % { Invoke-ScriptAnalyzer -Path $_ -Settings .\PSScriptAnalyz …
                       +               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    InvocationName   : Invoke-ScriptAnalyzer
    CommandOrigin    : Internal
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
                        at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo :

Environment data

> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.1.3
PSEdition                      Core
GitCommitId                    7.1.3
OS                             Microsoft Windows 10.0.19043
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

> (Get-Module -ListAvailable PSScriptAnalyzer).Version | ForEach-Object { $_.ToString() }

1.19.1

[rjmholt]

I suspect this occurs because accessing the Parameters property from off the pipeline thread is not a safe operation... I'm not sure how easy this will be to fix though

[Cyber5imon]

Still hitting this on the current release — PSScriptAnalyzer 1.25.0, PowerShell 7.6.4, Windows 10.0.26200 (Windows 11). Same signature as the original report:

System.NullReferenceException: Object reference not set to an instance of an object.
   at System.Management.Automation.CommandInfo.get_Parameters()
   at Microsoft.Windows.PowerShell.ScriptAnalyzer.BuiltinRules.UseCorrectCasing.AnalyzeScript(Ast ast, String fileName)+MoveNext()

A few things I narrowed down while investigating that might help reproduce it more reliably:

• A single file is enough. I didn't need a multi-file batch — running Invoke-ScriptAnalyzer -Path <one file> -Settings <settings.psd1> repeatedly against one unchanged .ps1 file reproduces it intermittently on its own.
• It's non-deterministic even in a brand-new process. Each attempt was a fresh pwsh -NoProfile process with no prior PSScriptAnalyzer state — so whatever's racing isn't accumulating across calls in one session, it can lose the race on the very first analysis a process ever does.
• Frequency tracked total rule/command volume, not any one rule. I could not reproduce it by running individual rules one at a time via -IncludeRule, or by running the full built-in rule set without a -Settings file. It only showed up when going through a -Settings psd1 that both configures a large number of rules (70+) and loads an additional custom rule module via CustomRulePath. That's consistent with more Get-Command-based casing lookups happening per analysis pass increasing the odds of hitting the race, which lines up with your note that this is "a gap in the fix for Collection was modified; enumeration operation may not execute when running Invoke-ScriptAnalyzer #1516."
• Module autoloading is a plausible trigger but not sufficient on its own. The file that reproduced it most reliably calls cmdlets from modules that get autoloaded during analysis (Get-CimInstance from CimCmdlets, Compress-Archive/Expand-Archive from Microsoft.PowerShell.Archive). My working theory was that UseCorrectCasing's Get-Command-based casing resolution races with PowerShell's module autoload. However, pre-importing both modules into the process before calling Invoke-ScriptAnalyzer did not reliably stop the crash, so autoload timing alone doesn't fully explain it.

Workaround in the meantime: disabled PSUseCorrectCasing and reimplemented equivalent cmdlet/parameter-casing checks as a custom external rule, wrapping every Get-Command / .Parameters access in try/catch so a resolution failure just skips that one command instead of taking down the whole analysis run. The short version of a real fix is probably the same shape: guard CommandInfo.Parameters access (matching what the linked fix for #1516 apparently did for CommandInfoCache), just evidently not covering every code path yet.

In case it's useful to anyone else blocked by this in the meantime, here's a drop-in replacement rule:

Measure-CorrectCasingSafe.psm1 (crash-safe stand-in for PSUseCorrectCasing)

using namespace Microsoft.Windows.PowerShell.ScriptAnalyzer.Generic
using namespace System.Collections.Generic
using namespace System.Collections.ObjectModel
using namespace System.Management.Automation.Language

function Measure-CorrectCasingSafe {
    <#
    .SYNOPSIS
        Crash-safe drop-in for PSUseCorrectCasing: flags cmdlet/function and parameter
        names whose casing doesn't match their canonical declared casing.
    .DESCRIPTION
        Every Get-Command / .Parameters access is wrapped in try/catch so a single
        unresolvable command is skipped instead of throwing the NullReferenceException
        that aborts the whole Invoke-ScriptAnalyzer run (see this issue).
    .PARAMETER ScriptBlockAst
        The ScriptBlockAst object provided by PSScriptAnalyzer.
    .OUTPUTS
        [DiagnosticRecord[]] Casing violations found.
    #>
    [CmdletBinding()]
    [OutputType([DiagnosticRecord[]])]
    param (
        [Parameter(Mandatory = $true)]
        [ScriptBlockAst]$ScriptBlockAst
    )

    begin {
        [List[DiagnosticRecord]]$Results = [List[DiagnosticRecord]]::new()
    }

    process {
        # PSScriptAnalyzer invokes external rules once per ScriptBlockAst in the file --
        # the root script AND separately for every nested function body. FindAll below
        # already recurses into nested functions from the root, so only the root
        # invocation should run, or violations inside nested functions get reported once
        # per enclosing scope.
        if ($null -ne $ScriptBlockAst.Parent) {
            return
        }

        [Collection[Ast]]$Commands = $ScriptBlockAst.FindAll({ $args[0] -is [CommandAst] }, $true)
        foreach ($Cmd in $Commands) {
            [CommandAst]$CommandAst = $Cmd
            [CommandElementAst]$NameElement = $CommandAst.CommandElements[0]
            if ($NameElement -isnot [StringConstantExpressionAst]) {
                continue
            }
            [String]$TypedName = $NameElement.Value

            [Object]$Resolved = $null
            try {
                $Resolved = Get-Command -Name $TypedName -ErrorAction Stop
            }
            catch {
                continue
            }
            if ($null -eq $Resolved) {
                continue
            }

            # A name that resolves case-insensitively but differs in case is a casing
            # issue; a name that resolves to something entirely different (an alias
            # like 'gps' for 'Get-Process') is not.
            if ($TypedName -ieq $Resolved.Name -and $TypedName -cne $Resolved.Name) {
                $Results.Add([DiagnosticRecord]@{
                        Message  = "'$TypedName' should be cased as '$($Resolved.Name)'."
                        Extent   = $NameElement.Extent
                        RuleName = 'PSUseCorrectCasingSafe'
                        Severity = 'Warning'
                    })
            }

            [Object]$Parameters = $null
            try {
                $Parameters = $Resolved.Parameters
            }
            catch {
                continue
            }
            if ($null -eq $Parameters) {
                continue
            }

            foreach ($Element in $CommandAst.CommandElements) {
                if ($Element -isnot [CommandParameterAst]) {
                    continue
                }
                [CommandParameterAst]$ParamAst = $Element
                [String]$TypedParam = $ParamAst.ParameterName

                if (-not $Parameters.ContainsKey($TypedParam)) {
                    continue
                }
                [String]$CanonicalParam = $Parameters[$TypedParam].Name
                if ($TypedParam -cne $CanonicalParam) {
                    $Results.Add([DiagnosticRecord]@{
                            Message  = "Parameter '-$TypedParam' should be cased as '-$CanonicalParam'."
                            Extent   = $ParamAst.Extent
                            RuleName = 'PSUseCorrectCasingSafe'
                            Severity = 'Warning'
                        })
                }
            }
        }
    }

    end {
        return [DiagnosticRecord[]]$Results.ToArray()
    }
}

Export-ModuleMember -Function Measure-CorrectCasingSafe

To use it: save as its own .psm1, exclude the built-in rule (-ExcludeRule PSUseCorrectCasing or 'PSUseCorrectCasing' = @{ Enable = $false } in your settings), and point Invoke-ScriptAnalyzer at the new file with -CustomRulePath.